In one aspect of the present disclosure, activities of users within an IT service end user are recorded. A given record of a user activity may include an output of a command executed by the user, and execution information, input parameter(s) to the command, output of the command, and/or any other type of execution information. In implementations, intelligence may be built into a proxy module corresponding to the command to track an execution of the command started by the user. The execution of the command is captured and stored in a buffer such that another user within the IT service end user can review the execution of the command. In another aspect, user interfaces are provided to facilitate a user within an IT service end user to review activities in administering IT services by another user within the IT service end user.